How Apyee Protects Your USDC: the 4 Emergency Triggers
Yield is only meaningful if your principal survives. Here are the four independent risk signals Apyee monitors — and how each one auto-exits affected protocols before contagion spreads.
Stablecoin yield products live or die on a single question: what happens when the underlying protocol fails? Most platforms answer with PR — "we have an emergency plan." Apyee answers with code. Four independent triggers, running every cycle, ready to pull funds out the moment any one fires.
This piece walks through each trigger: what it watches, how fast it acts, and what the failure mode looks like.
Why four triggers, not one
Single-trigger systems fail two ways: they fire on noise (false positive — you exit a healthy protocol and lose yield), or they miss the actual signal (false negative — you stay invested past the danger window). Apyee's Keeper (v2, 2026-05-13) uses four independent signals, three of which can trigger an exit on their own. The fourth (composite TVL+anomaly) requires two signals within a 10-minute window to fire — explicitly to filter false alarms.
The full list, in priority order:
| # | Signal | Source | Polling | Triggers exit? |
|---|---|---|---|---|
| 1 | Stablecoin depeg | Chainlink + CoinGecko | 1 min | Yes — single trigger |
| 2 | TVL crash | DefiLlama API | 5 min | Yes — single trigger |
| 3 | Contract pause | RPC WebSocket | Block-level | Yes — single trigger |
| 4 | Security webhook | PeckShield + partners | Real-time | Yes — single trigger |
A separate utilization monitor and a gas-price spike monitor exist, but they only generate alerts — not exits. Those are operational signals, not portfolio-protective signals.
1. Stablecoin depeg
What it watches. The price of USDC (and any stablecoin the vault touches) against $1.00, polled every minute from two independent sources:
- Chainlink price feed — onchain oracle, the same one used by Aave for liquidations
- CoinGecko aggregator — offchain CEX-weighted price
Both must agree the price is below a configurable safe band (default: $0.97) before the trigger fires.
Why two sources. A single oracle can be exploited or freeze. Chainlink is normally reliable but has occasionally lagged real market prices by 10–30 minutes during fast crashes (e.g., USDC March 2023). CoinGecko is more responsive but can show spurious lows during low-liquidity hours. Requiring agreement filters both failure modes.
What it does. If USDC depegs while Apyee holds positions in protocols that accept USDC as collateral or supply, those positions become vulnerable to liquidation cascades (because USDC's value backing other loans suddenly drops). The Keeper's response: emergencyWithdraw(<all USDC strategies>, "DEPEG"). All USDC is pulled to the vault's idle buffer, then reallocated to USDT or DAI strategies if available, or held idle until the depeg resolves.
Speed. First signal to action: typically 1–2 minutes. Median time-to-exit during the March 2023 USDC depeg simulation (offline backtest): 90 seconds from price first crossing $0.97.
Honest caveat. A flash depeg lasting under 60 seconds may not trigger before recovery. That's a deliberate tradeoff — chasing every tick would generate constant noise. The 1-minute polling matches the cadence at which liquidation cascades typically propagate.
2. TVL crash watch
What it watches. The total value locked of each strategy's underlying protocol, polled every 5 minutes from DefiLlama's public API. The Keeper compares the current value against a 1-hour rolling baseline.
Trigger threshold. A drop of −20% in 1 hour. That number is calibrated against historical incidents: every protocol exploit or rug we've studied since 2022 (Cream, Mango, Ronin, Multichain, etc.) showed a TVL drop steeper than −20% within the first hour. Normal market volatility — even during the 2022 Luna collapse — rarely produces a 1-hour drop steeper than −15% on healthy protocols.
Why this trigger is the most reliable. TVL is the consensus signal: if depositors are leaving fast, something has gone wrong, regardless of whether security firms or oracles have caught it. By the time TVL drops 20%, you're usually already a few minutes into a confirmed event.
What it does. emergencyWithdraw(<affected strategy>, "TVL_DROP"). The strategy is also added to the blacklist — even after the TVL recovers, the Keeper will not re-deploy funds there without manual operator review. This prevents the "we got out, oh it's fine, let's go back in" pattern that historically catches second-wave depositors in slow-bleed exploits.
Speed. First signal to action: 5–10 minutes (limited by DefiLlama's polling cadence + Keeper cycle).
Honest caveat. A slow-bleed exploit (e.g., −5% per hour over 8 hours) won't trigger this signal alone. That's where the other signals (security webhooks, contract pauses) come in as overlapping protection.
3. Contract pause / on-chain anomaly
What it watches. A WebSocket subscription to each strategy's underlying protocol contracts, listening for:
Paused()events — most protocols emit this when admins pause borrowing or withdrawals (e.g., Aave's guardian pause, Compound's pause guardian)- Oversized single borrows — flagged when a single transaction borrows >1% of the protocol's total supply within a single block (the pattern seen in many lending exploits)
- Protocol-specific events — e.g., Aave's
PriceOracleSentinelUpdated(signals oracle attack defense engaging), Morpho'sSkimevent after irregular liquidation paths
Why block-level matters. Some exploits complete in 1–3 blocks (12–36 seconds on Ethereum). API-based monitors (TVL, prices) won't catch these in time — the funds are gone before the next poll. WebSocket events fire within the same block, giving the Keeper a chance to act before the next victim.
What it does. emergencyWithdraw(<affected strategy>, "PROTOCOL_PAUSE" | "ANOMALY"). The Keeper's response is sequenced: detect → verify (one more block confirmation) → execute. Total response time: 24–48 seconds on Ethereum, much faster on L2s.
Honest caveat. False positives are real. Aave's Paused() event has fired in production for routine maintenance (e.g., pausing isolated assets for parameter updates). The Keeper requires the pause to be on the specific asset Apyee holds, not just any pause event in the protocol. Even with that filter, a 3-month log showed ~2 false-positive exits per year — acceptable given the alternative is missing real pauses.
4. Security webhooks
What it watches. Incoming webhook alerts from trusted DeFi security firms:
- PeckShield — onchain monitoring, posts exploit alerts publicly within minutes
- Other partners (configurable) — Forta, Halborn, etc., as integrations come online
What it does. When a webhook arrives, the Keeper parses the alert: which protocol is affected, what kind of incident, what severity. If the alert touches a protocol Apyee currently holds (Aave V3, Compound V3, Morpho, Spark, Fluid), an immediate emergencyWithdraw fires.
Speed. PeckShield typically posts alerts within 2–5 minutes of an exploit beginning. The Keeper's webhook handler-to-exit time is ~10 seconds, dominated by the on-chain transaction confirmation. End-to-end: 3–7 minutes from exploit start to vault exit, when PeckShield catches it.
Honest caveat. Webhooks are reactive — they fire after a security firm has detected and disclosed an incident. For very fast exploits (one-block attacks), the on-chain anomaly trigger (#3) is faster. PeckShield's value is for harder-to-detect cases: governance attacks, oracle manipulations, social engineering of multisigs.
How the four work together
The most resilient cases are the ones where multiple signals converge:
-
Kelp/Aave incident, 2024-07 (backtested):
Paused()event on Kelp fired first (signal #3), security webhook from PeckShield confirmed (#4), then Aave TVL dropped 22% (#2). Even if any single signal had been a false positive, the other two would have caught it. -
USDC depeg March 2023 (backtested): Chainlink price crossed $0.97 (#1), then security webhooks confirmed the Silicon Valley Bank exposure (#4). Both fired within 5 minutes of each other — fast enough to exit before peak liquidation pressure.
The Keeper logs every signal it sees, even ones that didn't trigger an exit. That history is exposed in the vault's onchain event log under reasonCode = emergency, reasonDetail containing the trigger name. You can audit it yourself.
What this protects you from — and what it doesn't
Protects: Protocol-level failures (exploits, depegs, governance attacks, oracle manipulations on individual protocols). You exit early; you survive.
Doesn't protect: Apyee's own smart contract bugs (mitigated through audits, but never zero risk). Wallet-side compromise (private key loss). Off-chain operational failures (Keeper bot downtime — which has its own redundancy but isn't covered here).
The Keeper itself runs on Vercel cron + a private RPC fallback chain. If the Keeper goes down entirely, your funds stay in the last allocated state. Withdrawals via the vault contract always work directly with your wallet — the Keeper is never on the withdraw path.
The takeaway
Yield aggregators that don't talk about risk are selling you a story. Apyee talks about risk first because the architecture exists first. Four independent triggers, each one verifiable on-chain, each one with a documented response. That's what the 15% performance fee earns: not a higher APY by 50 bps, but the discipline to not be in the protocol when the headlines start.
If you remember one thing: the value of an automated vault isn't the few extra basis points it captures during normal markets. It's the percent of principal it preserves the day something breaks. That's the math Apyee is built around.